Threat landscape
HTTP2Shell: the Brotli flaw reaches far beyond Node.js
HTTP2Shell is not a new flaw but CVE-2026-111497 in any software with a Brotli decoder. Who is affected, and why the version number misleads.
- 5 min read
European CTEM platform
Your company, through an attacker's eyes.
blacklens.io finds exposed systems, exploitable vulnerabilities and leaked credentials and tells you what to fix first.
Visuals show sample data.
Used by manufacturers, retailers, software companies and IT service providers across the DACH region.
blacklens.io in numbers
- Assets monitored
- 1M+
- Vulnerabilities identified
- 100K+
- Dark web leaks captured
- 50K+
- Integrations for cloud, SIEM and ticketing
- 20+
How it works
How blacklens.io sees your company.
Four steps, one platform: find what is exposed, assess what matters, get early warnings and prove the fix.
Step 1 of 4
Visuals show sample data.
01Discover
blacklens.io finds external, internal and cloud assets automatically, including forgotten systems, shadow IT and lookalike domains.
- External, internal and cloud
- Shadow IT
- Lookalike domains
Explore Attack Surface Management
Cloud accounts4 connectedResource publicly accessibleAWSHighAdmin accounts without MFAMicrosoft 365CriticalVM with public IPAzureMediumPublic API endpointGoogle CloudMedium02Assess
EPSS, CISA KEV and exploit status show what really matters. AI explains every finding, running as a self-hosted LLM in Europe.
- EPSS
- CISA KEV
- AI explanations
Explore Vulnerability Management
AI explanationself-hosted LLMCVE-2024-21762vpn.beispiel-gmbh.atKEVCritical- Root cause
- Outdated FortiOS version on the SSL VPN gateway.
- Impact
- Attackers can execute code without logging in.
- Remediation
- Update to FortiOS 7.0.14 or later.
03Warn early
New CVEs are matched against your inventory in real time. We also flag leaked identities and suppliers that appear on leak sites or slip in their weekly rating.
- Real-time CVE matching
- Dark web identities
- Supplier watchlist
Supplier watchlist12 suppliersLogistik Partner GmbHListed on a ransomware leak site, 30 min agoCriticalSoftware Zulieferer AGSoftwareNo hitsMuster SteuerberatungTax advisoryNo hits04Fix and prove
One workflow for every finding: assign, fix, close automatically after the re-scan and prove progress with reports.
- Jira, Teams, Slack
- Auto-close after re-scan
- Scheduled reports
Explore Unified Vulnerability Management
Remediationone workflow for every source12Open5In progress2Risk accepted48ClosedCVE-2024-21762- Assigned to IT operations
- Update installed
- Re-scan confirmed: closed automatically
Visuals show sample data.
Attackers see your company differently than your IT does.
blacklens.io shows the whole picture: external, internal, cloud, dark web and suppliers, in one platform and prioritised by real risk.
Newly discovered assets+4 since yesterday
beispiel-gmbh.atRoot domain
vpn.beispiel-gmbh.atFortiGate SSL-VPN 7.0.12Critical
dev-old.beispiel-gmbh.atGitLab 15.2Shadow ITHigh
mail.beispiel-gmbh.atExchange Server 2019Medium
203.0.113.24OpenSSH 8.9NewInfo
Attack Surface Management
Finds every domain, service and technology, including the forgotten ones.
Fix firstsorted by risk
1CVE-2024-21762vpn.beispiel-gmbh.atEPSS0.94KEV
2CVE-2024-21410mail.beispiel-gmbh.atEPSS0.62KEV
3TLS 1.0 enabledshop.beispiel-gmbh.atMedium
Vulnerability Management
200,000+ tests, prioritised by EPSS, CISA KEV and exploit status instead of CVSS alone.
Compromised identities3 new hits
m.hu•••@beispiel-gmbh.atStealer log, 2 h agoEmployee
Microsoft 365 session cookieStealer log, 5 h agoEmployee
k.wa•••@gmx.atCombolist, 3 days agoCustomer
Dark Web Monitoring
Leaked accounts with IAM context: privileged, without MFA or password unchanged since the leak.
Supplier ratings12 suppliers, avg. 74
Grade DSoftware Zulieferer AGCriticality: criticalGrade B → DKnown exploited63 of 100
Grade FDruckerei Muster KGCriticality: lowRansomware31 of 100
Grade ALogistik Partner GmbHCriticality: high94 of 100
Grade BMuster SteuerberatungCriticality: medium86 of 100
Supplier risk rating
NewRates your suppliers from the outside every week with a grade from A to F and alerts you when risk rises.
Early warning47 min ago
CVE-2024-21762FortiOS SSL-VPNCritical
- CVE published08:12
- 2 assets in your inventory affected09:00
- Confirmed by PoC scan09:26
- Alert sent to Microsoft Teams09:27
Early warning
New CVEs matched in real time against your inventory and verified automatically.
Sentry in the internal networkonline
Servers423 critical
Clients186
OT & IoT172 critical
Network91 critical
Active Directory12 accounts without sign-in for 90 daysMedium
Sentry: internal scanning
NewServers, clients, OT and Active Directory behind the firewall.
Penetration testmanually validated
Authentication can be bypassedportal.beispiel-gmbh.atVerified
Other users' records readable via APIapi.beispiel-gmbh.atRetest passed
No limit on login attemptsshop.beispiel-gmbh.atUnder review
Penetration Testing
Pentesters validate findings manually, with retest and report inside the platform.
Integrationsalerts, tickets, cloud
- Jira
- Microsoft Teams
- Slack
- GitHub
- GitLab
- Elastic
- AWS
- Microsoft Azure
- Google Cloud
- Cloudflare
- Hetzner
- Webhook
REST API250+ endpoints
Integrations
Alerts in Jira, Teams, Slack, Sentinel or Elastic. Everything via REST API too.
Visuals show sample data.
Platform
One platform. From source to remediation.
Every source feeds one analysis that prioritises by real risk. The result: tasks, reports and alerts in the tools you already use.
- 01
Sources
What attackers can see: from outside, in the internal network, in the cloud, on the dark web and at your suppliers.
- 02
Analysis
Prioritised by exploitability, explained in plain language and verified.
- 03
Action
Assigned, documented and where your team already works.
Dark Web Monitoring
What the dark web knows about your company.
Access brokers sell entry points before ransomware groups strike. blacklens.io finds compromised accounts, infected devices and stolen session cookies and turns them into findings.
- IAM match with Microsoft 365 and ADShows privileged accounts, missing MFA and passwords not changed since the leak.
- Ransomware leak sitesVictim lists matched against your supplier watchlist about every 30 minutes.
- Session cookiesStolen Microsoft 365 and VPN sessions are detected and assessed.
Compromised identityEmployee
m.hu•••@beispiel-gmbh.at
Stealer log, 2 h ago
IAMPrivilegedNo MFA
Visuals show sample data.
Data sovereignty
Made in Europe is not a marketing line for us.
Platform, scanners and AI run on European infrastructure, built and operated by an Austrian company.
DACH hosting
ISO 27001 and SOC 2 certified data centres, our own scanners only in Austria, Germany and Switzerland.
Self-hosted LLM/AI
No external AI providers, consent per workspace.
Austrian vendor
snapSEC GmbH in Vorchdorf, German-speaking support.
One licence, every module
Priced by assets, users and suppliers, reports, API and integrations included.
Security that companies trust.
Experiences from manufacturing, retail, software and IT services.
“blacklens.io is the ideal complement to our internal IT security measures. It continuously checks our externally reachable systems, tells us when action is needed and is an important building block of our cyber defence.”
“We were looking for a tool for automated penetration tests. What we found was a platform that lets us identify far more than potential entry points. Real added value for our SecOps.”
“blacklens.io helps us meet the state of the art by flagging vulnerabilities on externally available services very quickly. Together with dark web monitoring, visibility of IT and information security risks improved significantly.”
“blacklens.io helps us maintain an effective cyber defence internationally, permanently instead of one-time shots. It also keeps telling us whether ransomware threats endanger our supply chain.”
“With blacklens.io we have an excellent tool for proactive monitoring of all services and firewall configurations. It saves time and resources, and the reports immediately show where public services can be improved.”
“The blacklens.io package delivers relevant security information about your IT environment. It helps meet legal NIS requirements and, overall, makes an administrator's life more carefree.”
Latest analysis
Threat landscape
Node2Shell: why patching Node alone is not enough
Node2Shell exploits a flaw in the Brotli decoder that Node.js bundles. The fix ships in Node 22.23.4, 24.22.1 and 26.12.1 – and in Brotli itself.
- 5 min read
Threat landscape
Fortinet hardening release: patching without an advisory
Fortinet shipped critical fixes for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026. The advisories with CVE ids only follow on 10 November.
- 5 min read
Get started
See your attack surface within 24 hours.
We set up your workspace and walk you through the first findings.
- 14 days free, all features
- No credit card required
- We walk you through your first findings
Three steps to your first priority
- 1 Start
Connect domains and cloud
- 2 Within hours
First scan runs automatically
- 3 Within 24 hours
Prioritise and fix
Visuals show sample data.